VARA licensing explained: the seven activities, the pathway and the real cost

What VARA is, and when you need it

VARA is Dubai's standalone virtual-asset regulator, operating emirate-wide (including special development zones and free zones, with the exception of the DIFC, which has its own framework). If your business touches virtual assets on behalf of clients in or from Dubai, you need a VARA licence. There is no grace period, no "soft launch" exemption, and no distinction between retail and institutional: the obligation is binary.

The trigger is activity, not incorporation. A company incorporated in DMCC, for example, still requires VARA authorisation before it can handle client digital assets. Even major fintechs that obtained in-principle approval to offer crypto services in the UAE still had to go through the VARA process for their Dubai operations. If you are only building software or providing non-custodial, non-financial services, you may not need a licence, but the line is thinner than most founders assume. Get a proper scoping opinion before you commit to a structure.

The seven licensed activities, in plain terms

VARA licenses seven distinct activities, plus a separate token issuance category. Each one maps to a specific business model:

• Advisory services: providing recommendations or guidance on virtual-asset transactions to clients.
• Broker-dealer services: executing buy or sell orders on behalf of clients, acting as an intermediary.
• Custody services: safekeeping clients' virtual assets, including private-key management.
• Exchange services: operating a platform where users trade virtual assets against fiat or other virtual assets.
• Lending and borrowing: facilitating or providing virtual-asset lending, borrowing, or margin arrangements.
• Transfer and settlement: moving virtual assets between wallets or accounts, or settling obligations.
• Management and investment: managing portfolios or funds that include virtual assets.

Token issuance sits alongside these as a separate category. VARA recently expanded its rules to cover derivatives and refined its virtual-asset issuance framework, which signals the regime is maturing beyond spot trading. You apply only for the activities you intend to perform; there is no requirement to license all seven.

Bundling activities under one licence, and why custody is treated separately

A single entity can bundle multiple activities under one VARA licence. An exchange operator that also offers broker-dealer and transfer services, for instance, applies for all three under a single submission. This keeps the corporate structure clean and avoids the cost of maintaining separate licensed entities for related functions.

Custody is the exception. VARA imposes stricter segregation and governance requirements on custody providers, reflecting the higher risk profile of holding client assets. If your business model includes custody alongside exchange or broker-dealer services, expect additional capital requirements, independent board oversight obligations, and more granular reporting. Some firms choose to partner with a separately licensed custodian rather than taking on the compliance burden themselves. This is a structuring decision worth getting right early, because unwinding it later is expensive and slow.

The approval pathway: initial approval, conditions, full licence

The VARA licensing process follows a three-stage pathway, and understanding it prevents misplaced expectations.

The first stage is initial approval. You submit your application with supporting documentation: business plan, compliance framework, proof of substance, fit-and-proper checks on key personnel, and financial projections. VARA reviews the application and, if satisfied, grants an initial approval.

The second stage involves meeting conditions. VARA attaches specific conditions to the initial approval, which typically include finalising technology infrastructure, appointing compliance officers, completing external audits, and demonstrating adequate capital reserves. You cannot go live during this phase.

The third stage is the full licence. Once all conditions are met and verified, VARA grants the full operating licence. Only then can you onboard clients and process transactions.

Note that the "MVP licence" label you may see referenced in older guides is no longer a current standalone category. The pathway is initial approval, conditions, then full licence. Cosmos regularly helps founders map out this sequence, coordinating with licensed local legal partners to handle the regulated application work while advising on structuring, substance and compliance readiness.

What it actually costs

There is no single number for a VARA licence cost, and anyone quoting one is oversimplifying. The total outlay depends on the activities you are licensing, your capital requirements, and the complexity of your compliance infrastructure.

Broadly, you should budget for:

• Application and licensing fees payable to VARA, which vary by activity type and scale.
• Legal and advisory fees for preparing your application, compliance manual, and governance framework.
• Technology costs for building or procuring systems that meet VARA's standards for AML, transaction monitoring, and reporting.
• Ongoing compliance costs, including external audits, compliance officer salaries, and annual renewal fees.
• Minimum capital requirements, which differ significantly between, say, an advisory licence and a custody or exchange licence.

The total real cost of obtaining and maintaining a VARA licence can range from a few hundred thousand dirhams for a straightforward advisory licence to several million for a full exchange with custody. This is where Cosmos adds value: by helping you scope the right activities, avoid over-licensing, and structure your entity so that capital and compliance costs align with your actual business model rather than a worst-case assumption.

Timelines, and what slows them down

A full VARA licence typically takes six to twelve months from initial submission to go-live. Some applications move faster; many take longer. The variance almost always comes down to applicant readiness, not regulator delay.

The most common causes of slowdown are incomplete documentation at the initial submission stage, delays in appointing qualified compliance and governance personnel, technology infrastructure that does not meet VARA's standards on first review, and back-and-forth on capital adequacy calculations. Firms that arrive with a polished compliance framework, a clear business plan, and pre-vetted key personnel tend to move through the process materially faster.

One practical tip: do not wait until initial approval to start building your compliance and technology stack. VARA expects to see meaningful progress during the conditions phase, and starting from scratch at that point adds months. Detailed guidance on the application process and required documentation is publicly available, but the real acceleration comes from experienced structuring advice before you file.

VARA versus the alternatives

Dubai is not the only option in the UAE for virtual-asset businesses. Two alternatives come up frequently, and each suits a different profile.

ADGM, Abu Dhabi's international financial free zone, has its own regulator, the FSRA, which licenses virtual-asset activities under a separate framework. ADGM tends to attract institutional players and funds that want a common-law jurisdiction with its own court system. The regulatory bar is high, and costs are comparable to VARA, but the investor base and legal infrastructure differ.

RAK DAO is better suited for foundations, non-regulated web3 projects, and protocol-layer businesses that do not handle client assets. It is not a substitute for VARA if your model involves custody, exchange, or broker-dealer services.

DMCC is a Dubai free zone popular with commodity and trading firms, but a DMCC trade licence alone does not authorise you to handle client virtual assets. You still need VARA authorisation for that. Virtual-asset activity under VARA oversight has grown substantially, underscoring why most serious operators end up in the VARA regime. For a detailed comparison of these options, speak to the Cosmos team about which regime fits your specific business model.

Frequently asked questions

Can I operate a crypto exchange in Dubai without a VARA licence? No. Any exchange activity involving virtual assets conducted in or from Dubai requires VARA authorisation. Operating without one exposes you to enforcement action and potential criminal liability.

How many firms hold a VARA licence in 2026? A growing number of firms hold VARA licences, with approvals continuing to accelerate through 2026. Check VARA's public register for the current count.

Do I need a physical office in Dubai? Yes. VARA requires genuine commercial substance, including a physical office, local staff, and demonstrable operational presence. A brass-plate arrangement will not pass scrutiny.

Can a foreign company apply directly? You need a UAE-incorporated entity. Most applicants set up a free-zone or mainland company as the licensed vehicle, with the foreign parent as shareholder.

Is the MVP licence still available? The MVP label is no longer a current standalone category. The pathway runs from initial approval through conditions to a full licence.

The VARA regime is demanding by design: it filters for operators who are serious about compliance, capitalisation and long-term presence in Dubai. That rigour is precisely what gives the licence its credibility with institutional counterparties and banking partners. If you are evaluating whether Dubai is the right jurisdiction for your virtual-asset business, or if you have already decided and need to structure the application correctly, Cosmos can help you scope the right activities, coordinate with licensed legal partners, and build the compliance and corporate-tax framework that supports a successful application. Reach out to the Cosmos team to start the conversation.

This article is for informational purposes only and does not constitute legal or regulatory advice. VARA licensing involves regulated activities that must be handled by appropriately licensed professionals. Cosmos is not a regulator, law firm, or licensed virtual-asset service provider; it coordinates regulated licensing and legal work through licensed local partners.